Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomcat.embed:tomcat-embed-core

82 known vulnerabilities (14 critical, 32 high, 9 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
11.0.27 (Oct 6, 2026): no advisory affects it
Newest unaffected release
11.0.27 (Oct 6, 2026), the latest release
Advisories
82 · 14 critical, 32 high, 9 medium, 2 low
Dependents
1,160
Releases
473 since 7.0.0 (Jul 12, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-68525
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-65905
    Affects 7.0.30 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-65637
    Affects 9.0.115 to 9.0.120 (9.0.121 is outside it); 10.1.53 to 10.1.57 (10.1.59 is outside it); 11.0.20 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-65182
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-55957
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.100 (9.0.102 is outside it); 10.1.0-M1 to 10.1.36 (10.1.39 is outside it); 11.0.0-M1 to 11.0.4 (11.0.5 is outside it)
  • CVE-2026-55956
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-55276
    Affects 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-53404
    Affects 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-43515
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43514
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43513
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43512
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
Show all 82 advisoriesShow fewer advisories
  • CVE-2026-41293
    Affects 8.5.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-42498
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-41284
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-34487
    Affects 9.0.13 to 9.0.116 (9.0.117 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
  • CVE-2026-34483
    Affects 9.0.40 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
  • CVE-2026-32990
    Affects 9.0.113 to 9.0.115 (9.0.116 is outside it); 10.1.50 to 10.1.52 (10.1.53 is outside it); 11.0.15 to 11.0.18 (11.0.20 is outside it)
  • CVE-2026-29129
    Affects 9.0.115 (9.0.116 is outside it); 10.1.52 (10.1.53 is outside it); 11.0.18 (11.0.20 is outside it)
  • CVE-2026-25854
    Affects 8.5.30 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.52 (10.1.53 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
  • CVE-2026-24880
    Affects 7.0.0 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
  • CVE-2026-24734
    Affects 9.0.83 to 9.0.113 (9.0.115 is outside it); 10.1.0-M7 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.15 (11.0.18 is outside it)
  • CVE-2025-66614
    Affects 8.5.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it)
  • CVE-2025-61795
    Affects 8.5.0 to 9.0.109 (9.0.110 is outside it); 10.1.0-M1 to 10.1.46 (10.1.47 is outside it); 11.0.0-M1 to 11.0.11 (11.0.12 is outside it)
  • CVE-2025-55752
    Affects 8.5.6 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
  • CVE-2025-55754
    Affects 8.5.60 to 8.5.100 (9.0.0.M1 is outside it); 9.0.40 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
  • CVE-2025-55668
    Affects 9.0.0.M1 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-48989
    Affects 9.0.0.M1 to 9.0.107 (9.0.108 is outside it); 10.1.0-M1 to 10.1.43 (10.1.44 is outside it); 11.0.0-M1 to 11.0.9 (11.0.10 is outside it)
  • CVE-2025-53506
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
  • CVE-2025-52520
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
  • CVE-2025-52434
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it)
  • CVE-2025-49124
    Affects 9.0.24 to 9.0.105 (9.0.106 is outside it); 10.1.0 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-49125
    Affects 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-48988
    Affects 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-46701
    Affects 8.5.0 to 9.0.104 (9.0.105 is outside it); 10.1.0-M1 to 10.1.40 (10.1.41 is outside it); 11.0.0-M1 to 11.0.6 (11.0.7 is outside it)
  • CVE-2025-31651
    Affects 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
  • CVE-2025-31650
    Affects 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
  • CVE-2025-24813
    Affects 8.5.0 to 9.0.98 (9.0.99 is outside it); 10.1.0-M1 to 10.1.34 (10.1.35 is outside it); 11.0.0-M1 to 11.0.2 (11.0.3 is outside it)
  • CVE-2024-56337
    Affects 9.0.0.M1 to 9.0.97 (9.0.98 is outside it); 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
  • CVE-2024-50379
    Affects 8.5.0 to 9.0.97 (9.0.98 is outside it); 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
  • CVE-2024-52317
    Affects 9.0.93 to 9.0.95 (9.0.96 is outside it); 10.1.28 to 10.1.30 (10.1.31 is outside it); 11.0.0-M24 to 11.0.0-M26 (11.0.0 is outside it)
  • CVE-2024-38286
    Affects 7.0.92 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.35 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
  • CVE-2024-34750
    Affects 8.5.0 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
  • CVE-2024-24549
    Affects 8.5.0 to 8.5.98 (8.5.99 is outside it); 9.0.0.M1 to 9.0.85 (9.0.86 is outside it); 10.1.0-M1 to 10.1.18 (10.1.19 is outside it); 11.0.0-M1 to 11.0.0-M16 (11.0.0-M17 is outside it)
  • CVE-2024-21733
    Affects 8.5.8 to 8.5.63 (8.5.64 is outside it); 9.0.0.M1 to 9.0.43 (9.0.44 is outside it)
  • CVE-2023-46589
    Affects 8.5.0 to 8.5.95 (8.5.96 is outside it); 9.0.0.M1 to 9.0.82 (9.0.83 is outside it); 10.1.0-M1 to 10.1.15 (10.1.16 is outside it); 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
  • CVE-2023-45648
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-42795
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-44487
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.1 to 9.0.80 (9.0.81 is outside it); 10.0.0 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-41080
    Affects 8.5.0 to 8.5.92 (8.5.93 is outside it); 9.0.0.M1 to 9.0.79 (9.0.80 is outside it); 10.1.0-M1 to 10.1.12 (10.1.13 is outside it); 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
  • CVE-2023-34981
    Affects 9.0.74 (9.0.75 is outside it); 10.1.8 (10.1.9 is outside it); 11.0.0-M5 (11.0.0-M6 is outside it)
  • CVE-2023-28709
    Affects 9.0.71 to 9.0.73 (9.0.74 is outside it); 10.1.5 to 10.1.7 (10.1.8 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
  • CVE-2023-24998
    Affects 8.5.85 to 8.5.87 (8.5.88 is outside it); 9.0.0.M1 to 9.0.70 (9.0.71 is outside it); 10.1.0-M1 to 10.1.4 (10.1.5 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
  • CVE-2022-45143
    Affects 8.5.83 (8.5.84 is outside it); 9.0.40 to 9.0.68 (9.0.69 is outside it); 10.1.0 to 10.1.1 (10.1.2 is outside it)
  • CVE-2022-42252
    Affects 8.5.0 to 8.5.82 (8.5.83 is outside it); 9.0.0.M1 to 9.0.67 (9.0.68 is outside it); 10.0.0-M1 to 10.0.26 (10.0.27 is outside it); 10.1.0-M1 to 10.1.0 (10.1.1 is outside it)
  • CVE-2021-25329
    Affects 7.0.0 to 7.0.107 (7.0.108 is outside it); 8.0.1 to 8.5.60 (8.5.61 is outside it); 9.0.1 to 9.0.40 (9.0.41 is outside it); 10.0.0-M1 to 10.0.0 (10.0.2 is outside it)
  • CVE-2021-25122
    Affects 8.5.0 to 8.5.61 (8.5.63 is outside it); 9.0.0.M1 to 9.0.41 (9.0.43 is outside it); 10.0.0-M1 to 10.0.0 (10.0.2 is outside it)
  • CVE-2021-24122
    Affects 7.0.0 to 7.0.106 (7.0.107 is outside it); 8.5.0 to 8.5.59 (8.5.60 is outside it); 9.0.1 to 9.0.39 (9.0.40 is outside it); 10.0.0-M1 to 10.0.0-M9 (10.0.0-M10 is outside it)
  • CVE-2020-11996
    Affects 8.5.0 to 8.5.54 (8.5.55 is outside it); 9.0.0.M1 to 9.0.34 (9.0.35 is outside it); 10.0.0-M1 to 10.0.0-M4 (10.0.0-M5 is outside it)
  • CVE-2020-9484
    Affects 7.0.0 to 7.0.103 (7.0.104 is outside it); 8.0.1 to 8.5.54 (8.5.55 is outside it); 9.0.1 to 9.0.34 (9.0.35 is outside it); 10.0.0-M1 to 10.0.0-M4 (10.0.0-M5 is outside it)
  • CVE-2020-1938
    Affects 7.0.0 to 7.0.99 (7.0.100 is outside it); 8.0.1 to 8.5.50 (8.5.51 is outside it); 9.0.1 to 9.0.30 (9.0.31 is outside it)
  • CVE-2020-1935
    Affects 7.0.0 to 7.0.99 (7.0.100 is outside it); 8.0.1 to 8.5.50 (8.5.51 is outside it); 9.0.1 to 9.0.30 (9.0.31 is outside it)
  • CVE-2019-17569
    Affects 7.0.99 (7.0.100 is outside it); 8.5.49 to 8.5.50 (8.5.51 is outside it); 9.0.29 to 9.0.30 (9.0.31 is outside it)
  • CVE-2019-12418
    Affects 7.0.0 to 7.0.96 (7.0.99 is outside it); 8.0.1 to 8.5.47 (8.5.49 is outside it); 9.0.1 to 9.0.27 (9.0.29 is outside it)
  • CVE-2019-17563
    Affects 7.0.0 to 7.0.96 (7.0.99 is outside it); 8.0.1 to 8.5.49 (8.5.50 is outside it); 9.0.1 to 9.0.29 (9.0.30 is outside it)
  • CVE-2019-10072
    Affects 8.5.0 to 8.5.40 (8.5.41 is outside it); 9.0.0.M1 to 9.0.19 (9.0.20 is outside it)
  • CVE-2019-0221
    Affects 7.0.0 to 7.0.93 (7.0.94 is outside it); 8.5.0 to 8.5.39 (8.5.40 is outside it); 9.0.1 to 9.0.16 (9.0.17 is outside it)
  • CVE-2019-0232
    Affects 7.0.0 to 7.0.93 (7.0.94 is outside it); 8.0.1 to 8.5.39 (8.5.40 is outside it); 9.0.0.M1 to 9.0.16 (9.0.17 is outside it)
  • CVE-2019-0199
    Affects 8.0.1 to 8.5.37 (8.5.38 is outside it); 9.0.1 to 9.0.14 (9.0.16 is outside it)
  • CVE-2018-11784
    Affects 7.0.23 to 7.0.90 (7.0.91 is outside it); 8.5.0 to 8.5.33 (8.5.34 is outside it); 9.0.1 to 9.0.11 (9.0.12 is outside it)
  • CVE-2018-8037
    Affects 8.5.5 to 8.5.31 (8.5.32 is outside it); 9.0.0.M9 to 9.0.8 (9.0.10 is outside it)
  • CVE-2018-1336
    Affects 7.0.28 to 7.0.86 (7.0.88 is outside it); 8.0.0-RC1 to 8.0.50 (8.0.51 is outside it); 8.5.0 to 8.5.30 (8.5.31 is outside it); 9.0.0.M9 to 9.0.7 (9.0.8 is outside it)
  • CVE-2018-8034
    Affects 7.0.35 to 7.0.88 (7.0.90 is outside it); 8.0.1 to 8.0.52 (8.0.53 is outside it); 8.5.0 to 8.5.31 (8.5.32 is outside it); 9.0.1 to 9.0.8 (9.0.10 is outside it)
  • CVE-2018-8014
    Affects 7.0.41 to 7.0.86 (7.0.88 is outside it); 8.0.0-RC1 to 8.0.52 (8.0.53 is outside it); 8.5.0 to 8.5.31 (8.5.32 is outside it); 9.0.0.M1 to 9.0.8 (9.0.10 is outside it)
  • CVE-2018-1304
    Affects 7.0.0 to 7.0.85 (7.0.86 is outside it); 8.0.1 to 8.0.50 (8.0.51 is outside it); 8.5.0 to 8.5.27 (8.5.28 is outside it); 9.0.1 to 9.0.4 (9.0.5 is outside it)
  • CVE-2018-1305
    Affects 7.0.0 to 7.0.84 (7.0.85 is outside it); 8.5.0 to 8.5.27 (8.5.28 is outside it); 9.0.0.M1 to 9.0.4 (9.0.5 is outside it)
  • CVE-2017-12617
    Affects 7.0.0 to 7.0.81 (7.0.82 is outside it); 8.0.0-RC1 to 8.0.46 (8.0.47 is outside it); 8.5.0 to 8.5.21 (8.5.23 is outside it); 9.0.0.M1 to 9.0.0.M27 (9.0.1 is outside it)
  • CVE-2017-12615
    Affects 7.0.0 to 7.0.78 (7.0.79 is outside it)
  • CVE-2017-5651
    Affects 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M18 (9.0.0.M19 is outside it)
  • CVE-2017-5648
    Affects 7.0.0 to 7.0.75 (7.0.76 is outside it); 8.0.1 to 8.0.41 (8.0.42 is outside it); 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M17 (9.0.0.M18 is outside it)
  • CVE-2014-0095
    Affects 8.0.0-RC1 to 8.0.3 (8.0.5 is outside it)
  • CVE-2008-1947
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 82

  • CVE-2026-68525Critical 9.1

    Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-65905Critical 9.8

    Apache Tomcat: Limited replay attack possible with DIGEST authentication

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0.M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.30, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-65637Critical 9.8

    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

    Affected: from 11.0.20, fixed in 11.0.25; from 10.1.53, fixed in 10.1.59; from 9.0.115, fixed in 9.0.121.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-65182Critical 9.1

    Apache Tomcat: Bypass longest prefix security constraint

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    Affected: from 11.0.0-M1, fixed in 11.0.5; from 10.1.0-M1, fixed in 10.1.37; from 9.0.0.M1, fixed in 9.0.101; from 8.5.0, through 8.5.100; through 7.0.109.

    Fixed in 9.0.102 (released Mar 3, 2025, 483 days before disclosure, the advisory names 9.0.101, which was never published), 10.1.39 (released Mar 4, 2025, 482 days before disclosure, the advisory names 10.1.37, which was never published) and 11.0.5 (released Feb 28, 2025, 486 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-55956Medium 6.5

    Apache Tomcat: Security constraints for default servlet ignored method

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100; through 7.0.109.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-55276Critical 9.1

    Apache Tomcat: Logged effective web.xml is incomplete

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Bad ornext processing in RewriteValve

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-43515Critical 9.1

    Apache Tomcat: Security constraints not correctly applied

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: AJP secret compared in non-constant time

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-43512Critical 9.8

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-41293Critical 9.8

    Apache Tomcat: HTTP/2 request headers not validated

    Affected: from 8.5.0, fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: WebSocket authentication header exposure

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

Show all 82 advisoriesShow fewer advisories

  • Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

    Affected: from 9.0.13, fixed in 9.0.117; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.

    Fixed in 9.0.117 (released Mar 30, 2026, 10 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Incomplete escaping of JSON access logs

    Affected: from 9.0.40, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-32990Medium 5.3

    Apache Tomcat: Fix for CVE-2025-66614 is incomplete

    Affected: from 9.0.113, fixed in 9.0.116; from 10.1.50, fixed in 10.1.53; from 11.0.15, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: TLS cipher order is not preserved

    Affected: from 9.0.114, fixed in 9.0.116; from 10.1.51, fixed in 10.1.53; from 11.0.16, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-25854Medium 6.1

    Apache Tomcat: Occasionally open redirect

    Affected: from 8.5.30, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.53; from 11.0.0-M1, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Request smuggling via invalid chunk extension

    Affected: from 7.0.0, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.52; from 11.0.0-M1, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.52 (released Jan 23, 2026, 76 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

    Affected: from 11.0.0-M1, fixed in 11.0.18; from 10.1.0-M7, fixed in 10.1.52; from 9.0.83, fixed in 9.0.115.

    Fixed in 9.0.115 (released Jan 21, 2026, 27 days before disclosure), 10.1.52 (released Jan 23, 2026, 25 days before disclosure) and 11.0.18 (released Jan 23, 2026, 25 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Client certificate verification bypass due to virtual host mapping

    Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; from 9.0.0-M1, fixed in 9.0.113; from 8.5.0, through 8.5.100.

    Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-61795Medium 5.3

    Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

    Affected: from 11.0.0-M1, fixed in 11.0.12; from 10.1.0-M1, fixed in 10.1.47; from 9.0.0.M1, fixed in 9.0.110; from 8.5.0, through 8.5.100.

    Fixed in 9.0.110 (released Oct 1, 2025, 26 days before disclosure), 10.1.47 (released Oct 2, 2025, 25 days before disclosure) and 11.0.12 (released Oct 1, 2025, 26 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

    Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.0-M11, fixed in 9.0.109; from 8.5.6, through 8.5.100.

    Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-55754Critical 9.6

    Apache Tomcat: console manipulation via escape sequences in log messages

    Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.40, fixed in 9.0.109; from 8.5.60, through 8.5.100.

    Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-55668Medium 6.5

    Apache Tomcat: session fixation via rewrite valve

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106.

    Fixed in 9.0.106 (released Jun 5, 2025, 69 days before disclosure), 10.1.42 (released Jun 5, 2025, 69 days before disclosure) and 11.0.8 (released Jun 5, 2025, 69 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: h2 DoS - Made You Reset

    Affected: from 11.0.0-M1, fixed in 11.0.10; from 10.1.0-M1, fixed in 10.1.44; from 9.0.0.M1, fixed in 9.0.108.

    Fixed in 9.0.108 (released Jul 31, 2025, 13 days before disclosure), 10.1.44 (released Aug 4, 2025, 9 days before disclosure) and 11.0.10 (released Jul 31, 2025, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via excessive h2 streams at connection start

    Affected: from 8.5.0, through 8.5.100; from 9.0.0.M1, fixed in 9.0.107; from 10.1.0-M1, fixed in 10.1.43; from 11.0.0-M1, fixed in 11.0.9.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via integer overflow in multipart file upload

    Affected: from 11.0.0-M1, fixed in 11.0.9; from 10.1.0-M1, fixed in 10.1.43; from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: APR/Native Connector crash leading to DoS

    Affected: from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0, fixed in 10.1.42; from 9.0.23, fixed in 9.0.106.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Security constraint bypass for pre/post-resources

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: FileUpload large number of parts with headers DoS

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Security constraint bypass for CGI scripts

    Affected: from 9.0.0.M1, fixed in 9.0.105; from 10.1.0-M1, fixed in 10.1.41; from 11.0.0-M1, fixed in 11.0.7; from 8.5.0, through 8.5.100.

    Fixed in 9.0.105 (released May 7, 2025, 22 days before disclosure), 10.1.41 (released May 8, 2025, 21 days before disclosure) and 11.0.7 (released May 7, 2025, 22 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-31651Critical 9.8

    Apache Tomcat: Bypass of rules in Rewrite Valve

    Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.

    Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

    Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.

    Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-24813Critical 10.0 · KEV

    Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

    Affected: from 11.0.0-M1, fixed in 11.0.3; from 10.1.0-M1, fixed in 10.1.35; from 9.0.0.M1, fixed in 9.0.99; from 8.5.0, through 8.5.100.

    Fixed in 9.0.99 (released Feb 4, 2025, 34 days before disclosure), 10.1.35 (released Feb 4, 2025, 34 days before disclosure) and 11.0.3 (released Feb 4, 2025, 34 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-56337Critical 9.8

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

    Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34; from 9.0.0.M1, fixed in 9.0.98.

    Fixed in 9.0.98 (released Dec 5, 2024, 15 days before disclosure), 10.1.34 (released Dec 5, 2024, 15 days before disclosure) and 11.0.2 (released Dec 5, 2024, 15 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-50379Critical 9.8

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34; from 9.0.0.M1, fixed in 9.0.98; from 8.5.0, through 8.5.100.

    Fixed in 9.0.98 (released Dec 5, 2024, 12 days before disclosure), 10.1.34 (released Dec 5, 2024, 12 days before disclosure) and 11.0.2 (released Dec 5, 2024, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-52317Medium 6.5

    Apache Tomcat: Request/response mix-up with HTTP/2

    Affected: from 9.0.92, fixed in 9.0.96; from 10.1.27, fixed in 10.1.31; from 11.0.0-M23, fixed in 11.0.0.

    Fixed in 9.0.96 (released Oct 3, 2024, 46 days before disclosure), 10.1.31 (released Oct 3, 2024, 46 days before disclosure) and 11.0.0 (released Oct 3, 2024, 46 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Denial of Service

    Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.13, fixed in 9.0.90; from 8.5.35, through 8.5.100; from 7.0.92, through 7.0.109.

    Fixed in 9.0.90 (released Jun 14, 2024, 146 days before disclosure), 10.1.25 (released Jun 14, 2024, 146 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 146 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP/2 excess header handling DoS

    Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.0-M1, fixed in 9.0.90; from 8.5.0, through 8.5.100.

    Fixed in 9.0.90 (released Jun 14, 2024, 19 days before disclosure), 10.1.25 (released Jun 14, 2024, 19 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 19 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP/2 header handling DoS

    Affected: from 8.5.0, fixed in 8.5.99; from 9.0.0-M1, fixed in 9.0.86; from 10.1.0-M1, fixed in 10.1.19; from 11.0.0-M1, fixed in 11.0.0-M17.

    Fixed in 8.5.99 (released Feb 14, 2024, 28 days before disclosure), 9.0.86 (released Feb 14, 2024, 28 days before disclosure), 10.1.19 (released Feb 14, 2024, 28 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2024-21733Medium 5.3

    Apache Tomcat: Leaking of unrelated request bodies in default error page

    Affected: from 8.5.7, fixed in 8.5.64; from 9.0.0-M11, fixed in 9.0.44.

    Fixed in 8.5.64 (released Mar 4, 2021, 1051 days before disclosure) and 9.0.44 (released Mar 4, 2021, 1051 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Affected: from 11.0.0-M1, fixed in 11.0.0-M11; from 10.1.0-M1, fixed in 10.1.16; from 9.0.0-M1, fixed in 9.0.83; from 8.5.0, fixed in 8.5.96.

    Fixed in 8.5.96 (released Nov 10, 2023, 18 days before disclosure), 9.0.83 (released Nov 9, 2023, 19 days before disclosure), 10.1.16 (released Nov 10, 2023, 18 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2023-45648Medium 5.3

    Apache Tomcat: Trailer header parsing too lenient

    Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2023-42795Medium 5.3

    Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

    Affected: from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94; from 11.0.0-M1, fixed in 11.0.0-M12.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2023-44487High 7.5 · KEV

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.0.0, fixed in 10.1.14; from 9.0.0, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Open redirect with FORM authentication

    Affected: from 8.5.0, fixed in 8.5.93; from 9.0.0-M1, fixed in 9.0.80; from 10.1.0-M1, fixed in 10.1.13; from 11.0.0-M1, fixed in 11.0.0-M11.

    Fixed in 8.5.93 (released Aug 23, 2023, 2 days before disclosure), 9.0.80 (released Aug 23, 2023, 2 days before disclosure), 10.1.13 (released Aug 23, 2023, 2 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: AJP response header mix-up

    Affected: from 11.0.0-M5, fixed in 11.0.0-M6; from 10.1.8, fixed in 10.1.9; from 9.0.74, fixed in 9.0.75.

    Fixed in 9.0.75 (released May 4, 2023, 48 days before disclosure), 10.1.9 (released May 9, 2023, 43 days before disclosure) and 11.0.0-M6 (released May 3, 2023, 49 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Fix for CVE-2023-24998 is incomplete

    Affected: from 11.0.0-M2, fixed in 11.0.0-M5; from 10.1.5, fixed in 10.1.8; from 9.0.71, fixed in 9.0.74.

    Fixed in 9.0.74 (released Apr 13, 2023, 39 days before disclosure), 10.1.8 (released Apr 14, 2023, 38 days before disclosure) and 11.0.0-M5 (released Apr 12, 2023, 40 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    Affected: from 10.1.0-M1, fixed in 10.1.5; from 11.0.0-M2, fixed in 11.0.0-M5; from 8.5.85, fixed in 8.5.88; from 9.0.0-M1, fixed in 9.0.71.

    Fixed in 8.5.88 (released Apr 14, 2023, 53 days after disclosure), 9.0.71 (released Jan 9, 2023, 42 days before disclosure), 10.1.5 (released Jan 9, 2023, 42 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: JsonErrorReportValve escaping

    Affected: from 8.5.83, fixed in 8.5.84; from 9.0.40, fixed in 9.0.69; from 10.1.0, fixed in 10.1.2.

    Fixed in 8.5.84 (released Nov 16, 2022, 48 days before disclosure), 9.0.69 (released Nov 9, 2022, 55 days before disclosure) and 10.1.2 (released Nov 9, 2022, 55 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat request smuggling via malformed content-length

    Affected: from 8.5.0, fixed in 8.5.83; from 9.0.0-M1, fixed in 9.0.68; from 10.0.0-M1, fixed in 10.0.27; from 10.1.0-M1, fixed in 10.1.1.

    Fixed in 8.5.83 (released Oct 3, 2022, 29 days before disclosure), 9.0.68 (released Oct 3, 2022, 29 days before disclosure), 10.0.27 (released Oct 3, 2022, 29 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Incomplete fix for CVE-2020-9484

    Affected: from 10.0.0-M1, fixed in 10.0.2; from 9.0.0, fixed in 9.0.41; from 8.0.0, fixed in 8.5.61; from 7.0.0, fixed in 7.0.108.

    Fixed in 7.0.108 (released Jan 28, 2021, 32 days before disclosure), 8.5.61 (released Dec 3, 2020, 88 days before disclosure), 9.0.41 (released Dec 3, 2020, 88 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat h2c request mix-up

    Affected: from 10.0.0-M1, fixed in 10.0.2; from 9.0.0-M1, fixed in 9.0.43; from 8.5.0, fixed in 8.5.63.

    Fixed in 8.5.63 (released Jan 29, 2021, 31 days before disclosure), 9.0.43 (released Jan 28, 2021, 32 days before disclosure) and 10.0.2 (released Jan 28, 2021, 32 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat information disclosure

    Affected: from 10.0.0-M1, fixed in 10.0.0-M10; from 9.0.0, fixed in 9.0.40; from 8.5.0, fixed in 8.5.60; from 7.0.0, fixed in 7.0.107.

    Fixed in 7.0.107 (released Nov 18, 2020, 57 days before disclosure), 8.5.60 (released Nov 12, 2020, 63 days before disclosure), 9.0.40 (released Nov 12, 2020, 63 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t

    Affected: from 10.0.0-M1, fixed in 10.0.0-M5; from 9.0.0.M1, fixed in 9.0.35; from 8.5.0, fixed in 8.5.55.

    Fixed in 8.5.55 (released May 5, 2020, 52 days before disclosure), 9.0.35 (released May 5, 2020, 52 days before disclosure) and 10.0.0-M5 (released May 5, 2020, 52 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able

    Affected: from 10.0.0-M1, fixed in 10.0.0-M5; from 9.0.0, fixed in 9.0.35; from 8.0.0, fixed in 8.5.55; from 7.0.0, fixed in 7.0.104.

    Fixed in 7.0.104 (released May 7, 2020, 13 days before disclosure), 8.5.55 (released May 5, 2020, 15 days before disclosure), 9.0.35 (released May 5, 2020, 15 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2020-1938Critical 9.8 · KEV

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

    Affected: from 9.0.0, fixed in 9.0.31; from 8.0.0, fixed in 8.5.51; from 7.0.0, fixed in 7.0.100.

    Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsin

    Affected: fixed in 7.0.100; from 8.0.0, fixed in 8.5.51; from 9.0.0, fixed in 9.0.31.

    Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression.

    Affected: from 7.0.98, fixed in 7.0.100; from 8.5.48, fixed in 8.5.51; from 9.0.28, fixed in 9.0.31.

    Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attac

    Affected: fixed in 7.0.99; from 8.0.0, fixed in 8.5.49; from 9.0.0, fixed in 9.0.29.

    Fixed in 7.0.99 (released Dec 11, 2019, 12 days before disclosure), 8.5.49 (released Nov 17, 2019, 36 days before disclosure) and 9.0.29 (released Nov 16, 2019, 37 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an

    Affected: fixed in 7.0.99; from 8.0.0, fixed in 8.5.50; from 9.0.0, fixed in 9.0.30.

    Fixed in 7.0.99 (released Dec 11, 2019, 12 days before disclosure), 8.5.50 (released Dec 7, 2019, 16 days before disclosure) and 9.0.30 (released Dec 7, 2019, 16 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions…

    Affected: from 9.0.0.M1, fixed in 9.0.20; from 8.5.0, fixed in 8.5.41.

    Fixed in 8.5.41 (released May 4, 2019, 48 days before disclosure) and 9.0.20 (released May 3, 2019, 49 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without…

    Affected: from 9.0.0, fixed in 9.0.17; from 8.5.0, fixed in 8.5.40; from 7.0.0, fixed in 7.0.94.

    Fixed in 7.0.94 (released Apr 10, 2019, 48 days before disclosure), 8.5.40 (released Apr 10, 2019, 48 days before disclosure) and 9.0.17 (released Mar 13, 2019, 76 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and…

    Affected: from 9.0.0.M1, fixed in 9.0.17; from 8.0.0, fixed in 8.5.40; from 7.0.0, fixed in 7.0.94.

    Fixed in 7.0.94 (released Apr 10, 2019, 5 days before disclosure), 8.5.40 (released Apr 10, 2019, 5 days before disclosure) and 9.0.17 (released Mar 13, 2019, 33 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS…

    Affected: from 9.0.0, fixed in 9.0.16; from 8.0.0, fixed in 8.5.38.

    Fixed in 8.5.38 (released Feb 5, 2019, 64 days before disclosure) and 9.0.16 (released Feb 4, 2019, 65 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo

    Affected: from 8.5.0, fixed in 8.5.34; from 7.0.23, fixed in 7.0.91; from 9.0.0, fixed in 9.0.12.

    Fixed in 7.0.91 (released Sep 13, 2018, 21 days before disclosure), 8.5.34 (released Sep 4, 2018, 30 days before disclosure) and 9.0.12 (released Sep 4, 2018, 30 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition…

    Affected: from 9.0.0.M9, fixed in 9.0.10; from 8.5.5, fixed in 8.5.32.

    Fixed in 8.5.32 (released Jun 20, 2018, 43 days before disclosure) and 9.0.10 (released Jun 20, 2018, 43 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a…

    Affected: from 9.0.0.M9, fixed in 9.0.8; from 8.5.0, fixed in 8.5.31; from 8.0.0RC1, fixed in 8.0.51; from 7.0.28, fixed in 7.0.87.

    Fixed in 7.0.88 (released May 7, 2018, 87 days before disclosure, the advisory names 7.0.87, which was never published), 8.0.51 (released Apr 9, 2018, 115 days before disclosure), 8.5.31 (released Apr 27, 2018, 97 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • The host name verification when using TLS with the WebSocket client was missing.

    Affected: from 9.0.0, fixed in 9.0.10; from 8.5.0, fixed in 8.5.32; from 8.0.0, fixed in 8.0.53; from 7.0.35, fixed in 7.0.90.

    Fixed in 7.0.90 (released Jul 2, 2018, 30 days before disclosure), 8.0.53 (released Jun 29, 2018, 33 days before disclosure), 8.5.32 (released Jun 20, 2018, 42 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8

    Affected: from 9.0.0.M1, fixed in 9.0.9; from 8.5.0, fixed in 8.5.32; from 8.0.0RC1, fixed in 8.0.53; from 7.0.41, fixed in 7.0.88.

    Fixed in 7.0.88 (released May 7, 2018, 9 days before disclosure), 8.0.53 (released Jun 29, 2018, 44 days after disclosure), 8.5.32 (released Jun 20, 2018, 35 days after disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4

    Affected: from 9.0.0, fixed in 9.0.5; from 8.5.0, fixed in 8.5.28; from 8.0.0, fixed in 8.0.51; from 7.0.0, fixed in 7.0.86.

    Fixed in 7.0.86 (released Apr 9, 2018, 40 days after disclosure), 8.0.51 (released Apr 9, 2018, 40 days after disclosure), 8.5.28 (released Feb 6, 2018, 22 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t

    Affected: from 9.0.0M1, fixed in 9.0.5; from 8.5.0, fixed in 8.5.28; from 7.0.0, fixed in 7.0.85.

    Fixed in 7.0.85 (released Feb 7, 2018, 16 days before disclosure), 8.5.28 (released Feb 6, 2018, 17 days before disclosure) and 9.0.5 (released Feb 6, 2018, 17 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2017-12617High 8.1 · KEV

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

    Affected: from 9.0.0.M1, fixed in 9.0.1; from 8.5.0, fixed in 8.5.23; from 8.0.0-RC1, fixed in 8.0.47; from 7.0.0, fixed in 7.0.82.

    Fixed in 7.0.82 (released Sep 29, 2017, 4 days before disclosure), 8.0.47 (released Sep 29, 2017, 4 days before disclosure), 8.5.23 (released Sep 28, 2017, 5 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2017-12615High 8.1 · KEV

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

    Affected: from 7.0.0, fixed in 7.0.79.

    Fixed in 7.0.79 (released Jun 26, 2017, 85 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send…

    Affected: from 9.0.0.M1, fixed in 9.0.0.M19; from 8.5.0, fixed in 8.5.13.

    Fixed in 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 9.0.0.M19 (released Mar 27, 2017, 21 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.

    Affected: from 9.0.0.M1, fixed in 9.0.0.M18; from 8.5.0, fixed in 8.5.13; from 8.0.0, fixed in 8.0.42; from 7.0.0, fixed in 7.0.76.

    Fixed in 7.0.76 (released Mar 9, 2017, 39 days before disclosure), 8.0.42 (released Mar 8, 2017, 40 days before disclosure), 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of…

    Affected: from 8.0.0-RC1, fixed in 8.0.4.

    Fixed in 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published).

    The latest release, 11.0.27, is not affected.

  • Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject…

    Affected: from 5.5.9, fixed in 5.5.27; from 6.0.0, fixed in 6.0.18.

    Fixed in 7.0.0 (released Jul 12, 2010, 768 days after disclosure, the advisory names 5.5.27, which was never published).

    The latest release, 11.0.27, is not affected.